@payloadcms/plugin-mcp 4.0.0-canary.0 → 4.0.0-canary.2

package/dist/components/AccessField/index.css

@@ -3,32 +3,22 @@
     display: flex;
     flex-direction: column;
     gap: var(--base);
+    /* Breathing room below the API-key section's divider - the fields
+       container itself adds no gap between these two fields. */
+    padding-block-start: var(--spacer-4);
+    /* This custom field renders straight into `render-fields` (no `.field-type`
+       wrapper), so it must carry the standard inter-field margin itself -
+       otherwise the next field (e.g. an overrideApiKeyCollection field) butts
+       against the last card. */
+    margin-block-end: var(--spacer-3);
   }
 
-  .mcp-access-field__section {
-    display: flex;
-    flex-direction: column;
-    gap: calc(var(--base) / 2);
-    padding-bottom: var(--base);
-    /* Full-bleed separator: extend past the sidebar's horizontal gutter so the
-       border-block-end spans the entire sidebar width. */
-    margin-inline-start: calc(-1 * var(--sidebar-gutter-h-left, var(--gutter-h)));
-    margin-inline-end: calc(-1 * var(--sidebar-gutter-h-right, var(--gutter-h)));
-    padding-inline-start: var(--sidebar-gutter-h-left, var(--gutter-h));
-    padding-inline-end: var(--sidebar-gutter-h-right, var(--gutter-h));
-    border-block-end: 1px solid var(--theme-elevation-100);
-  }
-
-  .mcp-access-field__section:last-child {
-    border-block-end: none;
-  }
-
-  .mcp-access-field__section-header {
+  .mcp-access-field__header {
     display: flex;
     flex-direction: column;
   }
 
-  .mcp-access-field__section-header h4 {
+  .mcp-access-field__header h4 {
     margin: 0;
     color: var(--color-text);
     font-family: var(--text-heading-small-font-family);
@@ -38,7 +28,7 @@
     letter-spacing: var(--text-heading-small-letter-spacing);
   }
 
-  .mcp-access-field__section-header p {
+  .mcp-access-field__header p {
     margin: 0;
     color: var(--color-text-secondary);
     font-family: var(--text-body-medium-font-family);
@@ -48,38 +38,46 @@
     letter-spacing: var(--text-body-medium-letter-spacing);
   }
 
-  .mcp-access-field__group {
-    margin-block-end: calc(var(--base) / 2);
+  .mcp-access-field__tabbed-content {
+    display: flex;
+    flex-direction: column;
   }
 
-  .mcp-access-field__group-label {
-    font-weight: 600;
+  .mcp-access-field__cards {
+    display: flex;
+    flex-direction: column;
+    gap: calc(var(--base) / 2);
   }
 
-  .mcp-access-field__group-actions {
-    display: flex;
-    align-items: center;
-    gap: calc(var(--base) / 6);
+  /* The collapsible header is pointer-events: none so clicks reach the toggle
+     overlay; re-enable events on the checkbox and lift it above the toggle. */
+  .mcp-access-field__card-checkbox {
+    position: relative;
+    z-index: 1;
+    display: inline-flex;
+    pointer-events: auto;
   }
 
-  .mcp-access-field__action {
-    appearance: none;
-    background: none;
-    border: none;
-    color: var(--theme-elevation-500);
-    cursor: pointer;
-    font-size: 0.75rem;
-    padding: 0;
+  .mcp-access-field__leaf-group {
+    padding-block: calc(var(--base) / 2);
+    border-block-end: 1px solid var(--theme-elevation-100);
+  }
+
+  .mcp-access-field__leaf-group:first-child {
+    padding-block-start: 0;
   }
 
-  .mcp-access-field__action:hover {
-    color: var(--theme-text);
-    text-decoration: underline;
+  .mcp-access-field__leaf-group:last-child {
+    border-block-end: none;
+    padding-block-end: 0;
   }
 
-  .mcp-access-field__action-sep {
-    color: var(--theme-elevation-300);
-    font-size: 0.75rem;
+  .mcp-access-field__leaf-group-label {
+    margin: 0 0 calc(var(--base) / 2);
+    color: var(--color-text-secondary);
+    font-family: var(--text-body-medium-font-family);
+    font-size: var(--text-body-medium-font-size);
+    line-height: var(--text-body-medium-line-height);
   }
 
   .mcp-access-field__list {
@@ -88,6 +86,14 @@
     padding: 0;
     display: flex;
     flex-direction: column;
-    gap: calc(var(--base) / 3);
+    gap: calc(var(--base) / 2);
+  }
+
+  .mcp-access-field__leaf-description {
+    margin: calc(var(--base) / 6) 0 0;
+    color: var(--color-text-secondary);
+    font-family: var(--text-body-medium-font-family);
+    font-size: var(--text-body-medium-font-size);
+    line-height: var(--text-body-medium-line-height);
   }
 }

package/dist/components/SettingsMenu/index.client.d.ts

@@ -0,0 +1,8 @@
+import React from 'react';
+/**
+ * Entry in the user menu's Settings sub-popup linking to the API keys
+ * collection. The collection is excluded from the main nav
+ * (`admin.group: false`) and managed from here instead.
+ */
+export declare const MCPSettingsMenu: React.FC;
+//# sourceMappingURL=index.client.d.ts.map

package/dist/components/SettingsMenu/index.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../../../src/components/SettingsMenu/index.client.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,MAAM,OAAO,CAAA;AAOzB;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAiBnC,CAAA"}

package/dist/components/SettingsMenu/index.client.js

@@ -0,0 +1,29 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { PopupList, useConfig, useTranslation } from '@payloadcms/ui';
+import { formatAdminURL } from 'payload/shared';
+import React from 'react';
+/**
+ * Entry in the user menu's Settings sub-popup linking to the API keys
+ * collection. The collection is excluded from the main nav
+ * (`admin.group: false`) and managed from here instead.
+ */ export const MCPSettingsMenu = ()=>{
+    const { config } = useConfig();
+    const { t } = useTranslation();
+    return /*#__PURE__*/ _jsxs(PopupList.MenuItem, {
+        children: [
+            /*#__PURE__*/ _jsx(PopupList.GroupLabel, {
+                label: t('plugin-mcp:mcp')
+            }),
+            /*#__PURE__*/ _jsx(PopupList.Button, {
+                href: formatAdminURL({
+                    adminRoute: config.routes.admin,
+                    path: '/collections/payload-mcp-api-keys'
+                }),
+                children: t('plugin-mcp:manageAPIKeys')
+            })
+        ]
+    });
+};
+
+//# sourceMappingURL=index.client.js.map

package/dist/components/SettingsMenu/index.client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/components/SettingsMenu/index.client.tsx"],"sourcesContent":["'use client'\n\nimport { PopupList, useConfig, useTranslation } from '@payloadcms/ui'\nimport { formatAdminURL } from 'payload/shared'\nimport React from 'react'\n\nimport type {\n  PluginMCPTranslationKeys,\n  PluginMCPTranslations,\n} from '../../translations/index.js'\n\n/**\n * Entry in the user menu's Settings sub-popup linking to the API keys\n * collection. The collection is excluded from the main nav\n * (`admin.group: false`) and managed from here instead.\n */\nexport const MCPSettingsMenu: React.FC = () => {\n  const { config } = useConfig()\n  const { t } = useTranslation<PluginMCPTranslations, PluginMCPTranslationKeys>()\n\n  return (\n    <PopupList.MenuItem>\n      <PopupList.GroupLabel label={t('plugin-mcp:mcp')} />\n      <PopupList.Button\n        href={formatAdminURL({\n          adminRoute: config.routes.admin,\n          path: '/collections/payload-mcp-api-keys',\n        })}\n      >\n        {t('plugin-mcp:manageAPIKeys')}\n      </PopupList.Button>\n    </PopupList.MenuItem>\n  )\n}\n"],"names":["PopupList","useConfig","useTranslation","formatAdminURL","React","MCPSettingsMenu","config","t","MenuItem","GroupLabel","label","Button","href","adminRoute","routes","admin","path"],"mappings":"AAAA;;AAEA,SAASA,SAAS,EAAEC,SAAS,EAAEC,cAAc,QAAQ,iBAAgB;AACrE,SAASC,cAAc,QAAQ,iBAAgB;AAC/C,OAAOC,WAAW,QAAO;AAOzB;;;;CAIC,GACD,OAAO,MAAMC,kBAA4B;IACvC,MAAM,EAAEC,MAAM,EAAE,GAAGL;IACnB,MAAM,EAAEM,CAAC,EAAE,GAAGL;IAEd,qBACE,MAACF,UAAUQ,QAAQ;;0BACjB,KAACR,UAAUS,UAAU;gBAACC,OAAOH,EAAE;;0BAC/B,KAACP,UAAUW,MAAM;gBACfC,MAAMT,eAAe;oBACnBU,YAAYP,OAAOQ,MAAM,CAACC,KAAK;oBAC/BC,MAAM;gBACR;0BAECT,EAAE;;;;AAIX,EAAC"}

package/dist/endpoint/access.js

@@ -18,15 +18,15 @@ import { getPluginConfig } from '../utils/getPluginConfig.js';
             items: pluginConfig.items.filter((item)=>{
                 switch(item.type){
                     case 'collectionTool':
-                        return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.key] !== false;
+                        return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.configKey] !== false;
                     case 'globalTool':
-                        return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.key] !== false;
+                        return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.configKey] !== false;
                     case 'prompt':
-                        return apiKeyDoc.access.prompts?.[item.key] !== false;
+                        return apiKeyDoc.access.prompts?.[item.configKey] !== false;
                     case 'resource':
-                        return apiKeyDoc.access.resources?.[item.key] !== false;
+                        return apiKeyDoc.access.resources?.[item.configKey] !== false;
                     case 'tool':
-                        return apiKeyDoc.access.tools?.[item.key] !== false;
+                        return apiKeyDoc.access.tools?.[item.configKey] !== false;
                 }
             }),
             overrideAccess: typeof apiKeyDoc.overrideAccess === 'boolean' ? apiKeyDoc.overrideAccess : false,
@@ -93,6 +93,22 @@ const getAPIKeyDoc = async ({ logger, overrideApiKey, pluginConfig, req })=>{
     if (!user) {
         throw new UnauthorizedError();
     }
+    try {
+        await req.payload.db.updateOne({
+            id: doc.id,
+            collection: 'payload-mcp-api-keys',
+            data: {
+                lastUsed: new Date().toISOString()
+            },
+            req,
+            returning: false
+        });
+    } catch (err) {
+        logger.warn({
+            err,
+            msg: 'Failed to update MCP API key last-used timestamp'
+        });
+    }
     return {
         ...doc,
         user: {

package/dist/endpoint/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { DefaultDocumentIDType, PayloadRequest, TypedUser } from 'payload'\n\nimport crypto from 'crypto'\nimport { UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPAPIKeysDoc } from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\n/**\n * Resolves the API key (or dev-mode session) and returns the items the caller\n * may use. Denied items are dropped from the array.\n */\nexport const getAuthorizedMCP: (args: { req: PayloadRequest }) => Promise<AuthorizedMCP> = async ({\n  req,\n}) => {\n  const logger = getLogger({ payload: req.payload })\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const buildAuthorized = (apiKeyDoc: MCPAPIKeysDoc): AuthorizedMCP => ({\n    items: pluginConfig.items.filter((item) => {\n      switch (item.type) {\n        case 'collectionTool':\n          return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.key] !== false\n        case 'globalTool':\n          return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.key] !== false\n        case 'prompt':\n          return apiKeyDoc.access.prompts?.[item.key] !== false\n        case 'resource':\n          return apiKeyDoc.access.resources?.[item.key] !== false\n        case 'tool':\n          return apiKeyDoc.access.tools?.[item.key] !== false\n      }\n    }),\n    overrideAccess:\n      typeof apiKeyDoc.overrideAccess === 'boolean' ? apiKeyDoc.overrideAccess : false,\n    user: apiKeyDoc.user,\n  })\n\n  if (pluginConfig.overrideAuth) {\n    return await pluginConfig.overrideAuth({\n      getAPIKeyDoc: (overrideApiKey) => getAPIKeyDoc({ logger, overrideApiKey, pluginConfig, req }),\n      getAuthorizedMCP: ({ apiKeyDoc }) => buildAuthorized(apiKeyDoc),\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (process.env.NODE_ENV === 'development' && !hasBearerToken) {\n    logger.info('Dev mode: skipping API key check, using session user')\n    return buildAuthorized({\n      id: -1,\n      access: {},\n      overrideAccess: true,\n      user: req.user ?? null,\n    })\n  }\n\n  return buildAuthorized(await getAPIKeyDoc({ logger, pluginConfig, req }))\n}\n\nconst getAPIKeyDoc = async ({\n  logger,\n  overrideApiKey,\n  pluginConfig,\n  req,\n}: {\n  logger: ReturnType<typeof getLogger>\n  overrideApiKey?: string\n  pluginConfig: ReturnType<typeof getPluginConfig>\n  req: PayloadRequest\n}): Promise<MCPAPIKeysDoc> => {\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const apiKey =\n    overrideApiKey ?? (hasBearerToken ? authHeader?.replace('Bearer ', '').trim() || null : null)\n\n  if (!apiKey) {\n    throw new UnauthorizedError()\n  }\n\n  const sha256APIKeyIndex = crypto\n    .createHmac('sha256', req.payload.secret)\n    .update(apiKey)\n    .digest('hex')\n\n  const doc = await req.payload.db.findOne<MCPAPIKeysDoc>({\n    collection: 'payload-mcp-api-keys',\n    req,\n    where: {\n      apiKeyIndex: { equals: sha256APIKeyIndex },\n    },\n  })\n\n  if (!doc || !doc.user) {\n    throw new UnauthorizedError()\n  }\n\n  logger.info('API Key is valid')\n\n  const userRef = doc.user\n  const userID =\n    typeof userRef === 'object' && userRef !== null && 'id' in userRef\n      ? userRef.id\n      : (userRef as unknown as DefaultDocumentIDType)\n\n  const user = (await req.payload.findByID({\n    id: userID,\n    collection: pluginConfig.userCollection,\n    depth: 0,\n    disableErrors: true,\n    req,\n  })) as null | TypedUser\n\n  if (!user) {\n    throw new UnauthorizedError()\n  }\n\n  return {\n    ...doc,\n    user: {\n      ...user,\n      _strategy: 'mcp-api-key' as const,\n      collection: pluginConfig.userCollection,\n    },\n  }\n}\n"],"names":["crypto","UnauthorizedError","getLogger","getPluginConfig","getAuthorizedMCP","req","logger","payload","pluginConfig","config","authHeader","headers","get","hasBearerToken","startsWith","buildAuthorized","apiKeyDoc","items","filter","item","type","access","collections","collectionSlug","key","globals","globalSlug","prompts","resources","tools","overrideAccess","user","overrideAuth","getAPIKeyDoc","overrideApiKey","process","env","NODE_ENV","info","id","apiKey","replace","trim","sha256APIKeyIndex","createHmac","secret","update","digest","doc","db","findOne","collection","where","apiKeyIndex","equals","userRef","userID","findByID","userCollection","depth","disableErrors","_strategy"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,iBAAiB,QAAQ,UAAS;AAI3C,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,eAAe,QAAQ,8BAA6B;AAE7D;;;CAGC,GACD,OAAO,MAAMC,mBAA8E,OAAO,EAChGC,GAAG,EACJ;IACC,MAAMC,SAASJ,UAAU;QAAEK,SAASF,IAAIE,OAAO;IAAC;IAChD,MAAMC,eAAeL,gBAAgB;QAAEM,QAAQJ,IAAIE,OAAO,CAACE,MAAM;IAAC;IAElE,MAAMC,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAMC,kBAAkB,CAACC,YAA6C,CAAA;YACpEC,OAAOT,aAAaS,KAAK,CAACC,MAAM,CAAC,CAACC;gBAChC,OAAQA,KAAKC,IAAI;oBACf,KAAK;wBACH,OAAOJ,UAAUK,MAAM,CAACC,WAAW,EAAE,CAACH,KAAKI,cAAc,CAAC,EAAE,CAACJ,KAAKK,GAAG,CAAC,KAAK;oBAC7E,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACI,OAAO,EAAE,CAACN,KAAKO,UAAU,CAAC,EAAE,CAACP,KAAKK,GAAG,CAAC,KAAK;oBACrE,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACM,OAAO,EAAE,CAACR,KAAKK,GAAG,CAAC,KAAK;oBAClD,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACO,SAAS,EAAE,CAACT,KAAKK,GAAG,CAAC,KAAK;oBACpD,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACQ,KAAK,EAAE,CAACV,KAAKK,GAAG,CAAC,KAAK;gBAClD;YACF;YACAM,gBACE,OAAOd,UAAUc,cAAc,KAAK,YAAYd,UAAUc,cAAc,GAAG;YAC7EC,MAAMf,UAAUe,IAAI;QACtB,CAAA;IAEA,IAAIvB,aAAawB,YAAY,EAAE;QAC7B,OAAO,MAAMxB,aAAawB,YAAY,CAAC;YACrCC,cAAc,CAACC,iBAAmBD,aAAa;oBAAE3B;oBAAQ4B;oBAAgB1B;oBAAcH;gBAAI;YAC3FD,kBAAkB,CAAC,EAAEY,SAAS,EAAE,GAAKD,gBAAgBC;YACrDR;YACAH;QACF;IACF;IAEA,IAAI8B,QAAQC,GAAG,CAACC,QAAQ,KAAK,iBAAiB,CAACxB,gBAAgB;QAC7DP,OAAOgC,IAAI,CAAC;QACZ,OAAOvB,gBAAgB;YACrBwB,IAAI,CAAC;YACLlB,QAAQ,CAAC;YACTS,gBAAgB;YAChBC,MAAM1B,IAAI0B,IAAI,IAAI;QACpB;IACF;IAEA,OAAOhB,gBAAgB,MAAMkB,aAAa;QAAE3B;QAAQE;QAAcH;IAAI;AACxE,EAAC;AAED,MAAM4B,eAAe,OAAO,EAC1B3B,MAAM,EACN4B,cAAc,EACd1B,YAAY,EACZH,GAAG,EAMJ;IACC,MAAMK,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAM0B,SACJN,kBAAmBrB,CAAAA,iBAAiBH,YAAY+B,QAAQ,WAAW,IAAIC,UAAU,OAAO,IAAG;IAE7F,IAAI,CAACF,QAAQ;QACX,MAAM,IAAIvC;IACZ;IAEA,MAAM0C,oBAAoB3C,OACvB4C,UAAU,CAAC,UAAUvC,IAAIE,OAAO,CAACsC,MAAM,EACvCC,MAAM,CAACN,QACPO,MAAM,CAAC;IAEV,MAAMC,MAAM,MAAM3C,IAAIE,OAAO,CAAC0C,EAAE,CAACC,OAAO,CAAgB;QACtDC,YAAY;QACZ9C;QACA+C,OAAO;YACLC,aAAa;gBAAEC,QAAQX;YAAkB;QAC3C;IACF;IAEA,IAAI,CAACK,OAAO,CAACA,IAAIjB,IAAI,EAAE;QACrB,MAAM,IAAI9B;IACZ;IAEAK,OAAOgC,IAAI,CAAC;IAEZ,MAAMiB,UAAUP,IAAIjB,IAAI;IACxB,MAAMyB,SACJ,OAAOD,YAAY,YAAYA,YAAY,QAAQ,QAAQA,UACvDA,QAAQhB,EAAE,GACTgB;IAEP,MAAMxB,OAAQ,MAAM1B,IAAIE,OAAO,CAACkD,QAAQ,CAAC;QACvClB,IAAIiB;QACJL,YAAY3C,aAAakD,cAAc;QACvCC,OAAO;QACPC,eAAe;QACfvD;IACF;IAEA,IAAI,CAAC0B,MAAM;QACT,MAAM,IAAI9B;IACZ;IAEA,OAAO;QACL,GAAG+C,GAAG;QACNjB,MAAM;YACJ,GAAGA,IAAI;YACP8B,WAAW;YACXV,YAAY3C,aAAakD,cAAc;QACzC;IACF;AACF"}
+{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { DefaultDocumentIDType, PayloadRequest, TypedUser } from 'payload'\n\nimport crypto from 'crypto'\nimport { UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPAPIKeysDoc } from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\n/**\n * Resolves the API key (or dev-mode session) and returns the items the caller\n * may use. Denied items are dropped from the array.\n */\nexport const getAuthorizedMCP: (args: { req: PayloadRequest }) => Promise<AuthorizedMCP> = async ({\n  req,\n}) => {\n  const logger = getLogger({ payload: req.payload })\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const buildAuthorized = (apiKeyDoc: MCPAPIKeysDoc): AuthorizedMCP => ({\n    items: pluginConfig.items.filter((item) => {\n      switch (item.type) {\n        case 'collectionTool':\n          return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.configKey] !== false\n        case 'globalTool':\n          return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.configKey] !== false\n        case 'prompt':\n          return apiKeyDoc.access.prompts?.[item.configKey] !== false\n        case 'resource':\n          return apiKeyDoc.access.resources?.[item.configKey] !== false\n        case 'tool':\n          return apiKeyDoc.access.tools?.[item.configKey] !== false\n      }\n    }),\n    overrideAccess:\n      typeof apiKeyDoc.overrideAccess === 'boolean' ? apiKeyDoc.overrideAccess : false,\n    user: apiKeyDoc.user,\n  })\n\n  if (pluginConfig.overrideAuth) {\n    return await pluginConfig.overrideAuth({\n      getAPIKeyDoc: (overrideApiKey) => getAPIKeyDoc({ logger, overrideApiKey, pluginConfig, req }),\n      getAuthorizedMCP: ({ apiKeyDoc }) => buildAuthorized(apiKeyDoc),\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (process.env.NODE_ENV === 'development' && !hasBearerToken) {\n    logger.info('Dev mode: skipping API key check, using session user')\n    return buildAuthorized({\n      id: -1,\n      access: {},\n      overrideAccess: true,\n      user: req.user ?? null,\n    })\n  }\n\n  return buildAuthorized(await getAPIKeyDoc({ logger, pluginConfig, req }))\n}\n\nconst getAPIKeyDoc = async ({\n  logger,\n  overrideApiKey,\n  pluginConfig,\n  req,\n}: {\n  logger: ReturnType<typeof getLogger>\n  overrideApiKey?: string\n  pluginConfig: ReturnType<typeof getPluginConfig>\n  req: PayloadRequest\n}): Promise<MCPAPIKeysDoc> => {\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const apiKey =\n    overrideApiKey ?? (hasBearerToken ? authHeader?.replace('Bearer ', '').trim() || null : null)\n\n  if (!apiKey) {\n    throw new UnauthorizedError()\n  }\n\n  const sha256APIKeyIndex = crypto\n    .createHmac('sha256', req.payload.secret)\n    .update(apiKey)\n    .digest('hex')\n\n  const doc = await req.payload.db.findOne<MCPAPIKeysDoc>({\n    collection: 'payload-mcp-api-keys',\n    req,\n    where: {\n      apiKeyIndex: { equals: sha256APIKeyIndex },\n    },\n  })\n\n  if (!doc || !doc.user) {\n    throw new UnauthorizedError()\n  }\n\n  logger.info('API Key is valid')\n\n  const userRef = doc.user\n  const userID =\n    typeof userRef === 'object' && userRef !== null && 'id' in userRef\n      ? userRef.id\n      : (userRef as unknown as DefaultDocumentIDType)\n\n  const user = (await req.payload.findByID({\n    id: userID,\n    collection: pluginConfig.userCollection,\n    depth: 0,\n    disableErrors: true,\n    req,\n  })) as null | TypedUser\n\n  if (!user) {\n    throw new UnauthorizedError()\n  }\n\n  try {\n    await req.payload.db.updateOne({\n      id: doc.id,\n      collection: 'payload-mcp-api-keys',\n      data: { lastUsed: new Date().toISOString() },\n      req,\n      returning: false,\n    })\n  } catch (err) {\n    logger.warn({ err, msg: 'Failed to update MCP API key last-used timestamp' })\n  }\n\n  return {\n    ...doc,\n    user: {\n      ...user,\n      _strategy: 'mcp-api-key' as const,\n      collection: pluginConfig.userCollection,\n    },\n  }\n}\n"],"names":["crypto","UnauthorizedError","getLogger","getPluginConfig","getAuthorizedMCP","req","logger","payload","pluginConfig","config","authHeader","headers","get","hasBearerToken","startsWith","buildAuthorized","apiKeyDoc","items","filter","item","type","access","collections","collectionSlug","configKey","globals","globalSlug","prompts","resources","tools","overrideAccess","user","overrideAuth","getAPIKeyDoc","overrideApiKey","process","env","NODE_ENV","info","id","apiKey","replace","trim","sha256APIKeyIndex","createHmac","secret","update","digest","doc","db","findOne","collection","where","apiKeyIndex","equals","userRef","userID","findByID","userCollection","depth","disableErrors","updateOne","data","lastUsed","Date","toISOString","returning","err","warn","msg","_strategy"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,iBAAiB,QAAQ,UAAS;AAI3C,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,eAAe,QAAQ,8BAA6B;AAE7D;;;CAGC,GACD,OAAO,MAAMC,mBAA8E,OAAO,EAChGC,GAAG,EACJ;IACC,MAAMC,SAASJ,UAAU;QAAEK,SAASF,IAAIE,OAAO;IAAC;IAChD,MAAMC,eAAeL,gBAAgB;QAAEM,QAAQJ,IAAIE,OAAO,CAACE,MAAM;IAAC;IAElE,MAAMC,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAMC,kBAAkB,CAACC,YAA6C,CAAA;YACpEC,OAAOT,aAAaS,KAAK,CAACC,MAAM,CAAC,CAACC;gBAChC,OAAQA,KAAKC,IAAI;oBACf,KAAK;wBACH,OAAOJ,UAAUK,MAAM,CAACC,WAAW,EAAE,CAACH,KAAKI,cAAc,CAAC,EAAE,CAACJ,KAAKK,SAAS,CAAC,KAAK;oBACnF,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACI,OAAO,EAAE,CAACN,KAAKO,UAAU,CAAC,EAAE,CAACP,KAAKK,SAAS,CAAC,KAAK;oBAC3E,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACM,OAAO,EAAE,CAACR,KAAKK,SAAS,CAAC,KAAK;oBACxD,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACO,SAAS,EAAE,CAACT,KAAKK,SAAS,CAAC,KAAK;oBAC1D,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACQ,KAAK,EAAE,CAACV,KAAKK,SAAS,CAAC,KAAK;gBACxD;YACF;YACAM,gBACE,OAAOd,UAAUc,cAAc,KAAK,YAAYd,UAAUc,cAAc,GAAG;YAC7EC,MAAMf,UAAUe,IAAI;QACtB,CAAA;IAEA,IAAIvB,aAAawB,YAAY,EAAE;QAC7B,OAAO,MAAMxB,aAAawB,YAAY,CAAC;YACrCC,cAAc,CAACC,iBAAmBD,aAAa;oBAAE3B;oBAAQ4B;oBAAgB1B;oBAAcH;gBAAI;YAC3FD,kBAAkB,CAAC,EAAEY,SAAS,EAAE,GAAKD,gBAAgBC;YACrDR;YACAH;QACF;IACF;IAEA,IAAI8B,QAAQC,GAAG,CAACC,QAAQ,KAAK,iBAAiB,CAACxB,gBAAgB;QAC7DP,OAAOgC,IAAI,CAAC;QACZ,OAAOvB,gBAAgB;YACrBwB,IAAI,CAAC;YACLlB,QAAQ,CAAC;YACTS,gBAAgB;YAChBC,MAAM1B,IAAI0B,IAAI,IAAI;QACpB;IACF;IAEA,OAAOhB,gBAAgB,MAAMkB,aAAa;QAAE3B;QAAQE;QAAcH;IAAI;AACxE,EAAC;AAED,MAAM4B,eAAe,OAAO,EAC1B3B,MAAM,EACN4B,cAAc,EACd1B,YAAY,EACZH,GAAG,EAMJ;IACC,MAAMK,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAM0B,SACJN,kBAAmBrB,CAAAA,iBAAiBH,YAAY+B,QAAQ,WAAW,IAAIC,UAAU,OAAO,IAAG;IAE7F,IAAI,CAACF,QAAQ;QACX,MAAM,IAAIvC;IACZ;IAEA,MAAM0C,oBAAoB3C,OACvB4C,UAAU,CAAC,UAAUvC,IAAIE,OAAO,CAACsC,MAAM,EACvCC,MAAM,CAACN,QACPO,MAAM,CAAC;IAEV,MAAMC,MAAM,MAAM3C,IAAIE,OAAO,CAAC0C,EAAE,CAACC,OAAO,CAAgB;QACtDC,YAAY;QACZ9C;QACA+C,OAAO;YACLC,aAAa;gBAAEC,QAAQX;YAAkB;QAC3C;IACF;IAEA,IAAI,CAACK,OAAO,CAACA,IAAIjB,IAAI,EAAE;QACrB,MAAM,IAAI9B;IACZ;IAEAK,OAAOgC,IAAI,CAAC;IAEZ,MAAMiB,UAAUP,IAAIjB,IAAI;IACxB,MAAMyB,SACJ,OAAOD,YAAY,YAAYA,YAAY,QAAQ,QAAQA,UACvDA,QAAQhB,EAAE,GACTgB;IAEP,MAAMxB,OAAQ,MAAM1B,IAAIE,OAAO,CAACkD,QAAQ,CAAC;QACvClB,IAAIiB;QACJL,YAAY3C,aAAakD,cAAc;QACvCC,OAAO;QACPC,eAAe;QACfvD;IACF;IAEA,IAAI,CAAC0B,MAAM;QACT,MAAM,IAAI9B;IACZ;IAEA,IAAI;QACF,MAAMI,IAAIE,OAAO,CAAC0C,EAAE,CAACY,SAAS,CAAC;YAC7BtB,IAAIS,IAAIT,EAAE;YACVY,YAAY;YACZW,MAAM;gBAAEC,UAAU,IAAIC,OAAOC,WAAW;YAAG;YAC3C5D;YACA6D,WAAW;QACb;IACF,EAAE,OAAOC,KAAK;QACZ7D,OAAO8D,IAAI,CAAC;YAAED;YAAKE,KAAK;QAAmD;IAC7E;IAEA,OAAO;QACL,GAAGrB,GAAG;QACNjB,MAAM;YACJ,GAAGA,IAAI;YACPuC,WAAW;YACXnB,YAAY3C,aAAakD,cAAc;QACzC;IACF;AACF"}

package/dist/exports/client.d.ts

@@ -1,2 +1,5 @@
 export { AccessField } from '../components/AccessField/index.client.js';
+export { APIKeyField } from '../components/APIKeyField/index.client.js';
+export { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js';
+export { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js';
 //# sourceMappingURL=client.d.ts.map

package/dist/exports/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA"}

package/dist/exports/client.js

@@ -1,4 +1,7 @@
 'use client';
 export { AccessField } from '../components/AccessField/index.client.js';
+export { APIKeyField } from '../components/APIKeyField/index.client.js';
+export { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js';
+export { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js';
 
 //# sourceMappingURL=client.js.map

package/dist/exports/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["'use client'\nexport { AccessField } from '../components/AccessField/index.client.js'\n"],"names":["AccessField"],"mappings":"AAAA;AACA,SAASA,WAAW,QAAQ,4CAA2C"}
+{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["'use client'\nexport { AccessField } from '../components/AccessField/index.client.js'\nexport { APIKeyField } from '../components/APIKeyField/index.client.js'\nexport { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js'\nexport { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js'\n"],"names":["AccessField","APIKeyField","APIKeysEmptyState","MCPSettingsMenu"],"mappings":"AAAA;AACA,SAASA,WAAW,QAAQ,4CAA2C;AACvE,SAASC,WAAW,QAAQ,4CAA2C;AACvE,SAASC,iBAAiB,QAAQ,kDAAiD;AACnF,SAASC,eAAe,QAAQ,6CAA4C"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAM1F,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAiB,cAAc;QAC7B,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;KACjD;IACD,UAAU,iBAAiB;QACzB,uFAAuF;QACvF,wBAAwB,EAAE,eAAe,CAAA;KAC1C;CACF;AAED,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;AAExE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAElG,eAAO,MAAM,SAAS,wDAwCpB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAO1F,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAiB,cAAc;QAC7B,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;KACjD;IACD,UAAU,iBAAiB;QACzB,uFAAuF;QACvF,wBAAwB,EAAE,eAAe,CAAA;KAC1C;CACF;AAED,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;AAExE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAElG,eAAO,MAAM,SAAS,wDAkFpB,CAAA"}

package/dist/index.js

@@ -2,14 +2,14 @@ import { defaultUserCollection, definePlugin } from 'payload';
 import { getAPIKeysCollection } from './collection/index.js';
 import { mcpEndpoint } from './endpoint/index.js';
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
+import { translations } from './translations/index.js';
 export { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js';
 export const mcpPlugin = definePlugin({
     slug: '@payloadcms/plugin-mcp',
     order: 10,
     plugin: ({ config, plugins, ...rawConfig })=>{
-        // Our `payload-mcp-api-keys` is auth-enabled; if it'd be the only auth
-        // collection, Payload's later sanitize would pick it as `admin.user`.
-        // Pre-seed the default user collection to prevent that.
+        // If a project has no auth collection yet, add the default users collection
+        // so the relationship target and default `userCollection` exist.
         if (!config.admin?.user) {
             const firstCollectionWithAuth = (config.collections ?? []).find(({ auth })=>Boolean(auth));
             if (!firstCollectionWithAuth) {
@@ -31,6 +31,27 @@ export const mcpPlugin = definePlugin({
         (config.collections ??= []).push(getAPIKeysCollection({
             pluginConfig
         }));
+        if (!config.i18n) {
+            config.i18n = {};
+        }
+        if (!config.i18n.translations) {
+            config.i18n.translations = {};
+        }
+        const supportedLanguageKeys = config.i18n.supportedLanguages ? Object.keys(config.i18n.supportedLanguages) : [
+            'en'
+        ];
+        for (const lang of supportedLanguageKeys){
+            const pluginEntry = translations[lang];
+            if (!pluginEntry) {
+                continue;
+            }
+            const typedLocale = lang;
+            const existing = config.i18n.translations[typedLocale] ?? {};
+            config.i18n.translations[typedLocale] = {
+                ...existing,
+                'plugin-mcp': pluginEntry.translations['plugin-mcp']
+            };
+        }
         // Keep the API-keys collection registered even when disabled, so DB schema
         // and generated types don't drift between enabled/disabled environments.
         if (pluginConfig.disabled) {
@@ -38,6 +59,16 @@ export const mcpPlugin = definePlugin({
         }
         return {
             ...config,
+            admin: {
+                ...config.admin,
+                components: {
+                    ...config.admin?.components,
+                    userMenuSettingsItems: [
+                        ...config.admin?.components?.userMenuSettingsItems ?? [],
+                        '@payloadcms/plugin-mcp/client#MCPSettingsMenu'
+                    ]
+                }
+            },
             endpoints: [
                 ...config.endpoints ?? [],
                 // Payload prefixes /api, so the full path is /api/mcp.
@@ -45,6 +76,18 @@ export const mcpPlugin = definePlugin({
                     handler: mcpEndpoint,
                     method: 'post',
                     path: '/mcp'
+                },
+                // Streamable HTTP's optional server=>client GET stream. We don't offer
+                // one, so answer 405 per spec-— clients then skip it cleanly
+                {
+                    handler: ()=>new Response(null, {
+                            headers: {
+                                Allow: 'POST'
+                            },
+                            status: 405
+                        }),
+                    method: 'get',
+                    path: '/mcp'
                 }
             ]
         };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { defaultUserCollection, definePlugin } from 'payload'\n\nimport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAPIKeysCollection } from './collection/index.js'\nimport { mcpEndpoint } from './endpoint/index.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequest {\n    payloadAPI: 'GraphQL' | 'local' | 'MCP' | 'REST'\n  }\n  interface RegisteredPlugins {\n    /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nexport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }\n\nexport { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'\n\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, plugins, ...rawConfig }) => {\n    // Our `payload-mcp-api-keys` is auth-enabled; if it'd be the only auth\n    // collection, Payload's later sanitize would pick it as `admin.user`.\n    // Pre-seed the default user collection to prevent that.\n    if (!config.admin?.user) {\n      const firstCollectionWithAuth = (config.collections ?? []).find(({ auth }) => Boolean(auth))\n      if (!firstCollectionWithAuth) {\n        ;(config.collections ??= []).push(defaultUserCollection)\n      }\n    }\n\n    const pluginConfig = sanitizeMCPConfig({ config, pluginConfig: rawConfig })\n\n    // Stash the sanitized config on plugin options so `getPluginConfig()` reads it.\n    const registered = plugins['@payloadcms/plugin-mcp']\n    if (registered) {\n      // @ts-expect-error\n      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options\n    }\n\n    ;(config.collections ??= []).push(getAPIKeysCollection({ pluginConfig }))\n\n    // Keep the API-keys collection registered even when disabled, so DB schema\n    // and generated types don't drift between enabled/disabled environments.\n    if (pluginConfig.disabled) {\n      return config\n    }\n\n    return {\n      ...config,\n      endpoints: [\n        ...(config.endpoints ?? []),\n        // Payload prefixes /api, so the full path is /api/mcp.\n        { handler: mcpEndpoint, method: 'post', path: '/mcp' },\n      ],\n    }\n  },\n})\n"],"names":["defaultUserCollection","definePlugin","getAPIKeysCollection","mcpEndpoint","sanitizeMCPConfig","defineCollectionTool","defineGlobalTool","definePrompt","defineTool","mcpPlugin","slug","order","plugin","config","plugins","rawConfig","admin","user","firstCollectionWithAuth","collections","find","auth","Boolean","push","pluginConfig","registered","sanitizedOptions","disabled","endpoints","handler","method","path"],"mappings":"AAAA,SAASA,qBAAqB,EAAEC,YAAY,QAAQ,UAAS;AAI7D,SAASC,oBAAoB,QAAQ,wBAAuB;AAC5D,SAASC,WAAW,QAAQ,sBAAqB;AACjD,SAASC,iBAAiB,QAAQ,6BAA4B;AAc9D,SAASC,oBAAoB,EAAEC,gBAAgB,EAAEC,YAAY,EAAEC,UAAU,QAAQ,kBAAiB;AAElG,OAAO,MAAMC,YAAYR,aAA8B;IACrDS,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGC,WAAW;QACxC,uEAAuE;QACvE,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,CAACF,OAAOG,KAAK,EAAEC,MAAM;YACvB,MAAMC,0BAA0B,AAACL,CAAAA,OAAOM,WAAW,IAAI,EAAE,AAAD,EAAGC,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;YACtF,IAAI,CAACH,yBAAyB;;gBAC1BL,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACvB;YACpC;QACF;QAEA,MAAMwB,eAAepB,kBAAkB;YAAES;YAAQW,cAAcT;QAAU;QAEzE,gFAAgF;QAChF,MAAMU,aAAaX,OAAO,CAAC,yBAAyB;QACpD,IAAIW,YAAY;YACd,mBAAmB;YACnBA,WAAWC,gBAAgB,GAAGF;QAChC;;QAEEX,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACrB,qBAAqB;YAAEsB;QAAa;QAEtE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAIA,aAAaG,QAAQ,EAAE;YACzB,OAAOd;QACT;QAEA,OAAO;YACL,GAAGA,MAAM;YACTe,WAAW;mBACLf,OAAOe,SAAS,IAAI,EAAE;gBAC1B,uDAAuD;gBACvD;oBAAEC,SAAS1B;oBAAa2B,QAAQ;oBAAQC,MAAM;gBAAO;aACtD;QACH;IACF;AACF,GAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { AcceptedLanguages } from '@payloadcms/translations'\n\nimport { defaultUserCollection, definePlugin } from 'payload'\n\nimport type { PluginDefaultTranslationsObject } from './translations/types.js'\nimport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAPIKeysCollection } from './collection/index.js'\nimport { mcpEndpoint } from './endpoint/index.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { translations } from './translations/index.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequest {\n    payloadAPI: 'GraphQL' | 'local' | 'MCP' | 'REST'\n  }\n  interface RegisteredPlugins {\n    /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nexport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }\n\nexport { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'\n\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, plugins, ...rawConfig }) => {\n    // If a project has no auth collection yet, add the default users collection\n    // so the relationship target and default `userCollection` exist.\n    if (!config.admin?.user) {\n      const firstCollectionWithAuth = (config.collections ?? []).find(({ auth }) => Boolean(auth))\n      if (!firstCollectionWithAuth) {\n        ;(config.collections ??= []).push(defaultUserCollection)\n      }\n    }\n\n    const pluginConfig = sanitizeMCPConfig({ config, pluginConfig: rawConfig })\n\n    // Stash the sanitized config on plugin options so `getPluginConfig()` reads it.\n    const registered = plugins['@payloadcms/plugin-mcp']\n    if (registered) {\n      // @ts-expect-error\n      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options\n    }\n\n    ;(config.collections ??= []).push(getAPIKeysCollection({ pluginConfig }))\n\n    if (!config.i18n) {\n      config.i18n = {}\n    }\n\n    if (!config.i18n.translations) {\n      config.i18n.translations = {}\n    }\n\n    const supportedLanguageKeys = config.i18n.supportedLanguages\n      ? Object.keys(config.i18n.supportedLanguages)\n      : ['en']\n\n    for (const lang of supportedLanguageKeys) {\n      const pluginEntry = translations[lang as keyof typeof translations]\n      if (!pluginEntry) {\n        continue\n      }\n\n      const typedLocale = lang as AcceptedLanguages\n      const existing = (config.i18n.translations[typedLocale] ?? {}) as Record<string, unknown>\n      config.i18n.translations[typedLocale] = {\n        ...existing,\n        'plugin-mcp': pluginEntry.translations['plugin-mcp'],\n      } as PluginDefaultTranslationsObject\n    }\n\n    // Keep the API-keys collection registered even when disabled, so DB schema\n    // and generated types don't drift between enabled/disabled environments.\n    if (pluginConfig.disabled) {\n      return config\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...config.admin,\n        components: {\n          ...config.admin?.components,\n          userMenuSettingsItems: [\n            ...(config.admin?.components?.userMenuSettingsItems ?? []),\n            '@payloadcms/plugin-mcp/client#MCPSettingsMenu',\n          ],\n        },\n      },\n      endpoints: [\n        ...(config.endpoints ?? []),\n        // Payload prefixes /api, so the full path is /api/mcp.\n        { handler: mcpEndpoint, method: 'post', path: '/mcp' },\n        // Streamable HTTP's optional server=>client GET stream. We don't offer\n        // one, so answer 405 per spec-— clients then skip it cleanly\n        {\n          handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),\n          method: 'get',\n          path: '/mcp',\n        },\n      ],\n    }\n  },\n})\n"],"names":["defaultUserCollection","definePlugin","getAPIKeysCollection","mcpEndpoint","sanitizeMCPConfig","translations","defineCollectionTool","defineGlobalTool","definePrompt","defineTool","mcpPlugin","slug","order","plugin","config","plugins","rawConfig","admin","user","firstCollectionWithAuth","collections","find","auth","Boolean","push","pluginConfig","registered","sanitizedOptions","i18n","supportedLanguageKeys","supportedLanguages","Object","keys","lang","pluginEntry","typedLocale","existing","disabled","components","userMenuSettingsItems","endpoints","handler","method","path","Response","headers","Allow","status"],"mappings":"AAEA,SAASA,qBAAqB,EAAEC,YAAY,QAAQ,UAAS;AAK7D,SAASC,oBAAoB,QAAQ,wBAAuB;AAC5D,SAASC,WAAW,QAAQ,sBAAqB;AACjD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,YAAY,QAAQ,0BAAyB;AActD,SAASC,oBAAoB,EAAEC,gBAAgB,EAAEC,YAAY,EAAEC,UAAU,QAAQ,kBAAiB;AAElG,OAAO,MAAMC,YAAYT,aAA8B;IACrDU,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGC,WAAW;QACxC,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,CAACF,OAAOG,KAAK,EAAEC,MAAM;YACvB,MAAMC,0BAA0B,AAACL,CAAAA,OAAOM,WAAW,IAAI,EAAE,AAAD,EAAGC,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;YACtF,IAAI,CAACH,yBAAyB;;gBAC1BL,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACxB;YACpC;QACF;QAEA,MAAMyB,eAAerB,kBAAkB;YAAEU;YAAQW,cAAcT;QAAU;QAEzE,gFAAgF;QAChF,MAAMU,aAAaX,OAAO,CAAC,yBAAyB;QACpD,IAAIW,YAAY;YACd,mBAAmB;YACnBA,WAAWC,gBAAgB,GAAGF;QAChC;;QAEEX,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACtB,qBAAqB;YAAEuB;QAAa;QAEtE,IAAI,CAACX,OAAOc,IAAI,EAAE;YAChBd,OAAOc,IAAI,GAAG,CAAC;QACjB;QAEA,IAAI,CAACd,OAAOc,IAAI,CAACvB,YAAY,EAAE;YAC7BS,OAAOc,IAAI,CAACvB,YAAY,GAAG,CAAC;QAC9B;QAEA,MAAMwB,wBAAwBf,OAAOc,IAAI,CAACE,kBAAkB,GACxDC,OAAOC,IAAI,CAAClB,OAAOc,IAAI,CAACE,kBAAkB,IAC1C;YAAC;SAAK;QAEV,KAAK,MAAMG,QAAQJ,sBAAuB;YACxC,MAAMK,cAAc7B,YAAY,CAAC4B,KAAkC;YACnE,IAAI,CAACC,aAAa;gBAChB;YACF;YAEA,MAAMC,cAAcF;YACpB,MAAMG,WAAYtB,OAAOc,IAAI,CAACvB,YAAY,CAAC8B,YAAY,IAAI,CAAC;YAC5DrB,OAAOc,IAAI,CAACvB,YAAY,CAAC8B,YAAY,GAAG;gBACtC,GAAGC,QAAQ;gBACX,cAAcF,YAAY7B,YAAY,CAAC,aAAa;YACtD;QACF;QAEA,2EAA2E;QAC3E,yEAAyE;QACzE,IAAIoB,aAAaY,QAAQ,EAAE;YACzB,OAAOvB;QACT;QAEA,OAAO;YACL,GAAGA,MAAM;YACTG,OAAO;gBACL,GAAGH,OAAOG,KAAK;gBACfqB,YAAY;oBACV,GAAGxB,OAAOG,KAAK,EAAEqB,UAAU;oBAC3BC,uBAAuB;2BACjBzB,OAAOG,KAAK,EAAEqB,YAAYC,yBAAyB,EAAE;wBACzD;qBACD;gBACH;YACF;YACAC,WAAW;mBACL1B,OAAO0B,SAAS,IAAI,EAAE;gBAC1B,uDAAuD;gBACvD;oBAAEC,SAAStC;oBAAauC,QAAQ;oBAAQC,MAAM;gBAAO;gBACrD,uEAAuE;gBACvE,6DAA6D;gBAC7D;oBACEF,SAAS,IAAM,IAAIG,SAAS,MAAM;4BAAEC,SAAS;gCAAEC,OAAO;4BAAO;4BAAGC,QAAQ;wBAAI;oBAC5EL,QAAQ;oBACRC,MAAM;gBACR;aACD;QACH;IACF;AACF,GAAE"}

package/dist/mcp/buildMcpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAE3E,OAAO,KAAK,EACV,aAAa,EAIb,wBAAwB,EACzB,MAAM,aAAa,CAAA;AAiBpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,uCAI5B;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAmLH,CAAA"}
+{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAGvD,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,uCAI5B;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAuLH,CAAA"}

package/dist/mcp/buildMcpServer.js

@@ -1,14 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/server';
-import { APIError, configToJSONSchema } from 'payload';
-import { toCamelCase } from '../utils/camelCase.js';
+import { APIError } from 'payload';
+import { z } from 'zod';
 import { getLogger } from '../utils/getLogger.js';
-import { getCollectionVirtualFieldNames, getGlobalVirtualFieldNames } from '../utils/getVirtualFieldNames.js';
-import { removeVirtualFieldsFromSchema } from '../utils/schemaConversion/removeVirtualFieldsFromSchema.js';
 import { toStandardSchema } from '../utils/toStandardSchema.js';
-/** `findPosts`, `updateSiteSettings` — auto-prefixed wire name for collection/global tools. */ const wireName = (key, slug)=>{
-    const camel = toCamelCase(slug);
-    return `${key}${camel.charAt(0).toUpperCase()}${camel.slice(1)}`;
-};
 /**
  * Transport-agnostic core: registers every authorized MCP item onto a fresh
  * `McpServer` and returns it. The caller is responsible for picking a transport
@@ -36,72 +30,84 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
         const { doc: _doc, ...rest } = overridden;
         return rest;
     };
-    const configSchema = configToJSONSchema(req.payload.config, req.payload.db.defaultIDType, req.i18n, {
-        forceInlineBlocks: true
-    });
+    /**
+   * Runs a collection/global tool call:
+   * - reads `collectionSlug` / `globalSlug` from the input
+   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug
+   * - runs the tool handler and finalizes its response
+   */ const callEntityTool = async ({ input, item, serverContext })=>{
+        const entity = item.type === 'collectionTool' ? 'collection' : 'global';
+        const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug';
+        const toolInput = input ?? {};
+        const slug = toolInput[slugKey];
+        if (!slug) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Error: "${item.mcpName}" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`
+                    }
+                ],
+                isError: true
+            };
+        }
+        const match = authorizedMCP.items.find((candidate)=>candidate.type === item.type && candidate.mcpName === item.mcpName && (candidate.type === 'collectionTool' ? candidate.collectionSlug === slug : candidate.type === 'globalTool' && candidate.globalSlug === slug));
+        if (!match) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Error: MCP access to "${item.mcpName}" is not enabled for ${entity} "${slug}"`
+                    }
+                ],
+                isError: true
+            };
+        }
+        const handlerArgs = {
+            authorizedMCP,
+            input: toolInput,
+            req,
+            serverContext
+        };
+        const response = await (match.type === 'collectionTool' ? match.tool.handler({
+            ...handlerArgs,
+            collectionSlug: slug
+        }) : match.tool.handler({
+            ...handlerArgs,
+            globalSlug: slug
+        }));
+        return finalizeToolResponse(response, match.tool.overrideResponse);
+    };
     try {
+        const registeredEntityTools = new Set();
         for (const item of authorizedMCP.items){
             switch(item.type){
                 case 'collectionTool':
-                    {
-                        const tool = item.tool;
-                        const name = wireName(item.key, item.collectionSlug);
-                        let inputSchema = tool.input;
-                        if (typeof inputSchema === 'function') {
-                            const raw = configSchema.$defs?.[item.collectionSlug];
-                            if (!raw) {
-                                throw new APIError(`Collection schema not found for slug: ${item.collectionSlug}`, 500);
-                            }
-                            const collectionSchema = removeVirtualFieldsFromSchema(JSON.parse(JSON.stringify(raw)), getCollectionVirtualFieldNames(req.payload.config, item.collectionSlug));
-                            inputSchema = inputSchema({
-                                collectionSchema
-                            });
-                        }
-                        server.registerTool(name, {
-                            description: tool.description,
-                            inputSchema: inputSchema ? toStandardSchema(inputSchema) : undefined
-                        }, async (input, ctx)=>finalizeToolResponse(await tool.handler({
-                                authorizedMCP,
-                                collectionSlug: item.collectionSlug,
-                                input: input ?? {},
-                                req,
-                                serverContext: ctx
-                            }), tool.overrideResponse));
-                        logger.info(`✅ Tool: ${name} Registered.`);
-                        break;
-                    }
                 case 'globalTool':
                     {
-                        const tool = item.tool;
-                        const name = wireName(item.key, item.globalSlug);
-                        let inputSchema = tool.input;
-                        if (typeof inputSchema === 'function') {
-                            const raw = configSchema.$defs?.[item.globalSlug];
-                            if (!raw) {
-                                throw new APIError(`Global schema not found for slug: ${item.globalSlug}`, 500);
-                            }
-                            const globalSchema = removeVirtualFieldsFromSchema(JSON.parse(JSON.stringify(raw)), getGlobalVirtualFieldNames(req.payload.config, item.globalSlug));
-                            inputSchema = inputSchema({
-                                globalSchema
-                            });
+                        if (registeredEntityTools.has(item.mcpName)) {
+                            break;
                         }
-                        server.registerTool(name, {
-                            description: tool.description,
-                            inputSchema: inputSchema ? toStandardSchema(inputSchema) : undefined
-                        }, async (input, ctx)=>finalizeToolResponse(await tool.handler({
-                                authorizedMCP,
-                                globalSlug: item.globalSlug,
-                                input: input ?? {},
-                                req,
+                        registeredEntityTools.add(item.mcpName);
+                        const inputSchema = withSlugInput({
+                            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',
+                            input: item.tool.input
+                        });
+                        server.registerTool(item.mcpName, {
+                            description: item.tool.description,
+                            inputSchema: toStandardSchema(inputSchema)
+                        }, async (input, ctx)=>callEntityTool({
+                                input,
+                                item,
                                 serverContext: ctx
-                            }), tool.overrideResponse));
-                        logger.info(`✅ Tool: ${name} Registered.`);
+                            }));
+                        logger.info(`✅ Tool: ${item.mcpName} Registered.`);
                         break;
                     }
                 case 'prompt':
                     {
                         const prompt = item.prompt;
-                        server.registerPrompt(item.key, {
+                        server.registerPrompt(item.mcpName, {
                             argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,
                             description: prompt.description,
                             title: prompt.title
@@ -116,7 +122,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                 case 'resource':
                     {
                         const resource = item.resource;
-                        server.registerResource(item.key, // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)
+                        server.registerResource(item.mcpName, // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)
                         resource.uri, {
                             description: resource.description,
                             mimeType: resource.mimeType,
@@ -140,7 +146,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                 case 'tool':
                     {
                         const tool = item.tool;
-                        server.registerTool(item.key, {
+                        server.registerTool(item.mcpName, {
                             description: tool.description,
                             inputSchema: tool.input ? toStandardSchema(tool.input) : undefined
                         }, async (input, ctx)=>finalizeToolResponse(await tool.handler({
@@ -149,7 +155,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                                 req,
                                 serverContext: ctx
                             }), tool.overrideResponse));
-                        logger.info(`✅ Tool: ${item.key} Registered.`);
+                        logger.info(`✅ Tool: ${item.mcpName} Registered.`);
                         break;
                     }
             }
@@ -159,5 +165,35 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
     }
     return server;
 };
+const withSlugInput = ({ name, input })=>{
+    const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug';
+    const slugSchema = z.string().describe(description);
+    if (!input) {
+        return z.object({
+            [name]: slugSchema
+        });
+    }
+    if (input instanceof z.ZodObject) {
+        return input.extend({
+            [name]: slugSchema
+        });
+    }
+    const schema = input;
+    return {
+        ...schema,
+        type: 'object',
+        properties: {
+            ...schema.properties,
+            [name]: {
+                type: 'string',
+                description
+            }
+        },
+        required: Array.from(new Set([
+            name,
+            ...schema.required ?? []
+        ]))
+    };
+};
 
 //# sourceMappingURL=buildMcpServer.js.map